/*
 * sniffex.c
 *
 * Sniffer example of TCP/IP packet capture using libpcap.
 *
 * Version 0.1.1 (2005-07-05)
 * Copyright (c) 2005 The Tcpdump Group
 *
 * This software is intended to be used as a practical example and
 * demonstration of the libpcap library; available at:
 * http://www.tcpdump.org/
 *
 ****************************************************************************
 *
 * This software is a modification of Tim Carstens' "sniffer.c"
 * demonstration source code, released as follows:
 *
 * sniffer.c
 * Copyright (c) 2002 Tim Carstens
 * 2002-01-07
 * Demonstration of using libpcap
 * timcarst -at- yahoo -dot- com
 *
 * "sniffer.c" is distributed under these terms:
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. The name "Tim Carstens" may not be used to endorse or promote
 *    products derived from this software without prior written permission
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * <end of "sniffer.c" terms>
 *
 * This software, "sniffex.c", is a derivative work of "sniffer.c" and is
 * covered by the following terms:
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Because this is a derivative work, you must comply with the "sniffer.c"
 *    terms reproduced above.
 * 2. Redistributions of source code must retain the Tcpdump Group copyright
 *    notice at the top of this source file, this list of conditions and the
 *    following disclaimer.
 * 3. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. The names "tcpdump" or "libpcap" may not be used to endorse or promote
 *    products derived from this software without prior written permission.
 *
 * THERE IS ABSOLUTELY NO WARRANTY FOR THIS PROGRAM.
 * BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
 * FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
 * OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
 * PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
 * OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
 * TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
 * PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
 * REPAIR OR CORRECTION.
 *
 * IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
 * WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
 * REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
 * INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
 * OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
 * TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
 * YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
 * PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGES.
 * <end of "sniffex.c" terms>
 *
 ****************************************************************************
 *
 * Below is an excerpt from an email from Guy Harris on the tcpdump-workers
 * mail list when someone asked, "How do I get the length of the TCP
 * payload?" Guy Harris' slightly snipped response (edited by him to
 * speak of the IPv4 header length and TCP data offset without referring
 * to bitfield structure members) is reproduced below:
 *
 * The Ethernet size is always 14 bytes.
 *
 * <snip>...</snip>
 *
 * In fact, you *MUST* assume the Ethernet header is 14 bytes, *and*, if
 * you're using structures, you must use structures where the members
 * always have the same size on all platforms, because the sizes of the
 * fields in Ethernet - and IP, and TCP, and... - headers are defined by
 * the protocol specification, not by the way a particular platform's C
 * compiler works.)
 *
 * The IP header size, in bytes, is the value of the IP header length,
 * as extracted from the "ip_vhl" field of "struct sniff_ip" with
 * the "IP_HL()" macro, times 4 ("times 4" because it's in units of
 * 4-byte words).  If that value is less than 20 - i.e., if the value
 * extracted with "IP_HL()" is less than 5 - you have a malformed
 * IP datagram.
 *
 * The TCP header size, in bytes, is the value of the TCP data offset,
 * as extracted from the "th_offx2" field of "struct sniff_tcp" with
 * the "TH_OFF()" macro, times 4 (for the same reason - 4-byte words).
 * If that value is less than 20 - i.e., if the value extracted with
 * "TH_OFF()" is less than 5 - you have a malformed TCP segment.
 *
 * So, to find the IP header in an Ethernet packet, look 14 bytes after
 * the beginning of the packet data.  To find the TCP header, look
 * "IP_HL(ip)*4" bytes after the beginning of the IP header.  To find the
 * TCP payload, look "TH_OFF(tcp)*4" bytes after the beginning of the TCP
 * header.
 *
 * To find out how much payload there is:
 *
 * Take the IP *total* length field - "ip_len" in "struct sniff_ip"
 * - and, first, check whether it's less than "IP_HL(ip)*4" (after
 * you've checked whether "IP_HL(ip)" is >= 5).  If it is, you have
 * a malformed IP datagram.
 *
 * Otherwise, subtract "IP_HL(ip)*4" from it; that gives you the length
 * of the TCP segment, including the TCP header.  If that's less than
 * "TH_OFF(tcp)*4" (after you've checked whether "TH_OFF(tcp)" is >= 5),
 * you have a malformed TCP segment.
 *
 * Otherwise, subtract "TH_OFF(tcp)*4" from it; that gives you the
 * length of the TCP payload.
 *
 * Note that you also need to make sure that you don't go past the end
 * of the captured data in the packet - you might, for example, have a
 * 15-byte Ethernet packet that claims to contain an IP datagram, but if
 * it's 15 bytes, it has only one byte of Ethernet payload, which is too
 * small for an IP header.  The length of the captured data is given in
 * the "caplen" field in the "struct pcap_pkthdr"; it might be less than
 * the length of the packet, if you're capturing with a snapshot length
 * other than a value >= the maximum packet size.
 * <end of response>
 *
 ****************************************************************************
 *
 * Example compiler command-line for GCC:
 *   gcc -Wall -o sniffex sniffex.c -lpcap
 *
 ****************************************************************************
 *
 * Code Comments
 *
 * This section contains additional information and explanations regarding
 * comments in the source code. It serves as documentaion and rationale
 * for why the code is written as it is without hindering readability, as it
 * might if it were placed along with the actual code inline. References in
 * the code appear as footnote notation (e.g. [1]).
 *
 * 1. Ethernet headers are always exactly 14 bytes, so we define this
 * explicitly with "#define". Since some compilers might pad structures to a
 * multiple of 4 bytes - some versions of GCC for ARM may do this -
 * "sizeof (struct sniff_ethernet)" isn't used.
 *
 * 2. Check the link-layer type of the device that's being opened to make
 * sure it's Ethernet, since that's all we handle in this example. Other
 * link-layer types may have different length headers (see [1]).
 *
 * 3. This is the filter expression that tells libpcap which packets we're
 * interested in (i.e. which packets to capture). Since this source example
 * focuses on IP and TCP, we use the expression "ip", so we know we'll only
 * encounter IP packets. The capture filter syntax, along with some
 * examples, is documented in the tcpdump man page under "expression."
 * Below are a few simple examples:
 *
 * Expression			Description
 * ----------			-----------
 * ip					Capture all IP packets.
 * tcp					Capture only TCP packets.
 * tcp port 80			Capture only TCP packets with a port equal to 80.
 * ip host 10.1.2.3		Capture all IP packets to or from host 10.1.2.3.
 *
 ****************************************************************************
 *
 */

#define APP_NAME		"sniffex"
#define APP_DESC		"Sniffer example using libpcap"
#define APP_COPYRIGHT	"Copyright (c) 2005 The Tcpdump Group"
#define APP_DISCLAIMER	"THERE IS ABSOLUTELY NO WARRANTY FOR THIS PROGRAM."

#include <arpa/inet.h>
#include <ctype.h>
#include <errno.h>
#include <getopt.h>
#include <netinet/in.h>
#include <pcap.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>

/* default snap length (maximum bytes per packet to capture) */
#define SNAP_LEN 1518

/* ethernet headers are always exactly 14 bytes [1] */
#define SIZE_ETHERNET 14

/* Ethernet addresses are 6 bytes */
#define ETHER_ADDR_LEN	6

/* Ethernet header */
struct sniff_ethernet {
    u_char ether_dhost[ETHER_ADDR_LEN]; /* destination host address */
    u_char ether_shost[ETHER_ADDR_LEN]; /* source host address */
    u_short ether_type; /* IP? ARP? RARP? etc */
};

/* IP header */
struct sniff_ip {
    u_char ip_vhl; /* version << 4 | header length >> 2 */
    u_char ip_tos; /* type of service */
    u_short ip_len; /* total length */
    u_short ip_id; /* identification */
    u_short ip_off; /* fragment offset field */
#define IP_RF 0x8000            /* reserved fragment flag */
#define IP_DF 0x4000            /* dont fragment flag */
#define IP_MF 0x2000            /* more fragments flag */
#define IP_OFFMASK 0x1fff       /* mask for fragmenting bits */
    u_char ip_ttl; /* time to live */
    u_char ip_p; /* protocol */
    u_short ip_sum; /* checksum */
    struct in_addr ip_src, ip_dst; /* source and dest address */
};
#define IP_HL(ip)               (((ip)->ip_vhl) & 0x0f)
#define IP_V(ip)                (((ip)->ip_vhl) >> 4)

/* TCP header */
typedef u_int tcp_seq;

struct sniff_tcp {
    u_short th_sport; /* source port */
    u_short th_dport; /* destination port */
    tcp_seq th_seq; /* sequence number */
    tcp_seq th_ack; /* acknowledgement number */
    u_char th_offx2; /* data offset, rsvd */
#define TH_OFF(th)      (((th)->th_offx2 & 0xf0) >> 4)
    u_char th_flags;
#define TH_FIN  0x01
#define TH_SYN  0x02
#define TH_RST  0x04
#define TH_PUSH 0x08
#define TH_ACK  0x10
#define TH_URG  0x20
#define TH_ECE  0x40
#define TH_CWR  0x80
#define TH_FLAGS        (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
    u_short th_win; /* window */
    u_short th_sum; /* checksum */
    u_short th_urp; /* urgent pointer */
};

struct sniff_udp {
    u_short th_sport; /* source port */
    u_short th_dport; /* destination port */
    u_short th_offx2; /* data offset, rsvd */
    u_short th_sum; /* checksum */
};

struct tcp_conn {
    int state;
    tcp_seq th_seq; /* sequence number */
    u_short th_sport; /* source port */
    u_short th_dport; /* destination port */
    struct in_addr ip_src, ip_dst; /* source and dest address */
};

typedef struct sniff_tcp sniff_tcp;
typedef struct sniff_udp sniff_udp;
typedef struct tcp_conn tcp_conn;

pcap_dumper_t * package_file = NULL;
int count = 1, size_transport = -1; /* packet counter */
float narp = 0, nrarp = 0, nip = 0, ntcp = 0, nudp = 0;

tcp_conn * conn1, * conn2;

void
got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet);

void
print_payload(const u_char *payload, int len);

void
print_hex_ascii_line(const u_char *payload, int len, int offset);

void
print_app_banner(void);

void
print_app_usage(void);

/*
 * app name/banner
 */
void
print_app_banner(void) {

    printf("%s - %s\n", APP_NAME, APP_DESC);
    printf("%s\n", APP_COPYRIGHT);
    printf("%s\n", APP_DISCLAIMER);
    printf("\n");

    return;
}

/*
 * print help text
 */
void
print_app_usage(void) {

    printf("Usage: %s -hifrw [interface]\n", APP_NAME);
    printf("\n");
    printf("Options:\n");
    printf("\t--help\t\t-h\t\tListen on <interface> for packets.\n");
    printf("\t--interface\t-i interface\t\tListen on <interface> for packets.\n");
    printf("\t--filter\t-f 'filter'\t\tApply <filter> for packets.\n");
    printf("\t--reader\t-r reader_file\t\tOpen <reader_file> for packets stored in it.\n");
    printf("\t--writer\t-w writer_file\t\tOpen <writer_file> to store packet on it.\n");

    printf("\n");

    return;
}

/*
 * print data in rows of 16 bytes: offset   hex   ascii
 *
 * 00000   47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a   GET / HTTP/1.1..
 */
void
print_hex_ascii_line(const u_char *payload, int len, int offset) {

    int i;
    int gap;
    const u_char *ch;

    /* offset */
    printf("%05d   ", offset);

    /* hex */
    ch = payload;
    for (i = 0; i < len; i++) {
        printf("%02x ", *ch);
        ch++;
        /* print extra space after 8th byte for visual aid */
        if (i == 7)
            printf(" ");
    }
    /* print space to handle line less than 8 bytes */
    if (len < 8)
        printf(" ");

    /* fill hex gap with spaces if not full line */
    if (len < 16) {
        gap = 16 - len;
        for (i = 0; i < gap; i++) {
            printf("   ");
        }
    }
    printf("   ");

    /* ascii (if printable) */
    ch = payload;
    for (i = 0; i < len; i++) {
        if (isprint(*ch))
            printf("%c", *ch);
        else
            printf(".");
        ch++;
    }

    printf("\n");

    return;
}

/*
 * print packet payload data (avoid printing binary data)
 */
void
print_payload(const u_char *payload, int len) {

    int len_rem = len;
    int line_width = 16; /* number of bytes per line */
    int line_len;
    int offset = 0; /* zero-based offset counter */
    const u_char *ch = payload;

    if (len <= 0)
        return;

    /* data fits on one line */
    if (len <= line_width) {
        print_hex_ascii_line(ch, len, offset);
        return;
    }

    /* data spans multiple lines */
    for (;;) {
        /* compute current line length */
        line_len = line_width % len_rem;
        /* print line */
        print_hex_ascii_line(ch, line_len, offset);
        /* compute total remaining */
        len_rem = len_rem - line_len;
        /* shift pointer to remaining bytes to print */
        ch = ch + line_len;
        /* add offset */
        offset = offset + line_width;
        /* check if we have line width chars or less */
        if (len_rem <= line_width) {
            /* print last line and get out */
            print_hex_ascii_line(ch, len_rem, offset);
            break;
        }
    }

    return;
}

char* convert(char n, char * output) {
    int i, j, lenght = sizeof (char) *8;
    char my_output[lenght + 1];
    my_output[lenght] = '\0';
    for (i = lenght - 1, j = 0; i >= 0; i--, j++)
        sprintf((char *) & my_output[j], "%c", (n & (1 << i)) ? '1' : '0');
    return strcpy(output, my_output);
}

char * get_tcp_flags(char * flags) {
    char * flags_char = malloc(sizeof (char));
    flags_char[0] = '\0';
    int i;

    for (i = 2; i < 8; i++) {
        if (flags[i] == '1') {
            if (strlen(flags_char) != 0) {
                flags_char = realloc(flags_char, strlen(flags_char) + 2);
                strcat(flags_char, "-");
            }
            flags_char = realloc(flags_char, strlen(flags_char) + 6);
            switch (i) {
                case 2:
                    strcat(flags_char, "[URG]");
                    break;
                case 3:
                    strcat(flags_char, "[ACK]");
                    break;
                case 4:
                    strcat(flags_char, "[PSH]");
                    break;
                case 5:
                    strcat(flags_char, "[RST]");
                    break;
                case 6:
                    strcat(flags_char, "[SYN]");
                    break;
                case 7:
                    strcat(flags_char, "[FIN]");
                    break;
            }
        }
    }
    return flags_char;
}

int print_tcp_header(sniff_tcp *tcp) {
    int size_tcp = TH_OFF(tcp)*4;
    if (size_tcp < 20) {
        printf("\t* Invalid TCP header length: %u bytes\n", size_tcp);
        return -1;
    }

    char * flags_output = malloc(sizeof (char) *9);

    printf("\t\tPuerto origen: %d\n", ntohs(tcp->th_sport));
    printf("\t\tPuerto destino: %d\n", ntohs(tcp->th_dport));
    printf("\t\tNúmero de secuencia: %d\n", ntohs(tcp->th_seq));
    printf("\t\tNúmero de reconocimiento: %d\n", ntohs(tcp->th_ack));
    printf("\t\tVentana de recepción: %d\n", ntohs(tcp->th_win));
    printf("\t\tFlags: %s\n", get_tcp_flags(convert(tcp->th_flags, flags_output)));
    printf("\t\tSuma de comprobación: %d\n", ntohs(tcp->th_sum));
    printf("\t\tLongitud de cabecera: %d\n", size_tcp);
    printf("\t\tDatos urgentes: %d\n", ntohs(tcp->th_urp));

    const struct sniff_ip* ip;
    ip = (struct sniff_ip*) (((u_char *) tcp) - 20);

    switch (tcp->th_flags) {
        case 2:
            if (conn1->state == 0) {
                conn1->ip_dst = ip->ip_dst;
                conn1->ip_src = ip->ip_src;
                conn1->th_dport = tcp->th_dport;
                conn1->th_sport = tcp->th_sport;
                conn1->state++;
                printf("SOLICITANDO CONEXION TCP Nº 1\n");
            } else
                if (conn2->state == 0) {
                conn2->ip_dst = ip->ip_dst;
                conn2->ip_src = ip->ip_src;
                conn2->th_dport = tcp->th_dport;
                conn2->th_sport = tcp->th_sport;
                conn2->state++;
                printf("SOLICITANDO CONEXION TCP Nº 2\n");
            }
            break;
        case 18:
            if (conn1->state == 1
                    && conn1->ip_dst.s_addr == ip->ip_src.s_addr
                    && conn1->ip_src.s_addr == ip->ip_dst.s_addr
                    && conn1->th_dport == tcp->th_sport
                    && conn1->th_sport == tcp->th_dport) {
                conn1->state++;
                conn1->th_seq = ntohs(tcp->th_seq);
                printf("ESTABLECIENDO CONEXION TCP Nº 1\n");
            } else
                if (conn2->state == 1
                    && conn2->ip_dst.s_addr == ip->ip_src.s_addr
                    && conn2->ip_src.s_addr == ip->ip_dst.s_addr
                    && conn2->th_dport == tcp->th_sport
                    && conn2->th_sport == tcp->th_dport) {
                conn2->state++;
                conn2->th_seq = ntohs(tcp->th_seq);
                printf("ESTABLECIENDO CONEXION TCP Nº 2\n");
            }
            break;
    }
    if (tcp->th_flags == 16) {
        if (conn1->state == 2
                && conn1->ip_dst.s_addr == ip->ip_dst.s_addr
                && conn1->ip_src.s_addr == ip->ip_src.s_addr
                && conn1->th_dport == tcp->th_dport
                && conn1->th_sport == tcp->th_sport
                && conn1->th_seq == ntohs(tcp->th_ack)) {
            conn1->state++;
            printf("CONEXIÓN TCP Nº 1 ESTABLECIDA\n");
        } else
            if (conn2->state == 2
                && conn2->ip_dst.s_addr == ip->ip_dst.s_addr
                && conn2->ip_src.s_addr == ip->ip_src.s_addr
                && conn2->th_dport == tcp->th_dport
                && conn2->th_sport == tcp->th_sport
                && conn2->th_seq == ntohs(tcp->th_ack)) {
            conn2->state++;
            printf("CONEXIÓN TCP Nº 2 ESTABLECIDA\n");
            exit(0);
        }
    }



    free(flags_output);
    return size_tcp;
}

int print_udp_header(sniff_udp *udp) {
    int size_udp = ntohs(udp->th_offx2);
    if (size_udp < 8) {
        printf("\t* Invalid UDP segment length: %u bytes\n", size_udp);
        return -1;
    }

    printf("\t\tPuerto origen: %d\n", ntohs(udp->th_sport));
    printf("\t\tPuerto destino: %d\n", ntohs(udp->th_dport));
    printf("\t\tSuma de comprobación: %d\n", ntohs(udp->th_sum));
    printf("\t\tLongitud del segmento: %d\n", ntohs(udp->th_offx2));

    return 8;
}

void
manage_tcp_header(const u_char *packet, int size_ip) {
    struct sniff_tcp *tcp; /* The TCP header */
    tcp = (struct sniff_tcp*) (packet + SIZE_ETHERNET + size_ip);
    if ((size_transport = print_tcp_header(tcp)) == -1)
        return;
    ntcp++;
}

void
manage_udp_header(const u_char *packet, int size_ip) {
    struct sniff_udp *udp; /* The UDP header */
    udp = (struct sniff_udp*) (packet + SIZE_ETHERNET + size_ip);
    if ((size_transport = print_udp_header(udp)) == -1)
        return;
    nudp++;
}

void
manage_ip_header(const u_char *packet) {
    const struct sniff_ip *ip; /* The IP header */
    const u_char *payload; /* Packet payload */
    int size_ip, size_payload;

    /* define/compute ip header offset                                                  */
    /*                  V                                                               */
    /*                  V                                                               */
    /*                  V                                                               */
    /************************************************************************************/
    /* 	ETHERNET	|	IP	|	TCP/UDP		|	PAYLOAD		*/
    /************************************************************************************/
    ip = (struct sniff_ip*) (packet + SIZE_ETHERNET);
    size_ip = IP_HL(ip)*4;
    if (size_ip < 20) {
        printf("\t* Invalid IP header length: %u bytes\n", size_ip);
        return;
    }
    nip++;

    /* print source and destination IP addresses */
    printf("\tFrom: %s\n", inet_ntoa(ip->ip_src));
    printf("\tTo: %s\n", inet_ntoa(ip->ip_dst));

    /* determine protocol */
    switch (ip->ip_p) {
        case IPPROTO_TCP:
            printf("\tProtocol: TCP\n");
            manage_tcp_header(packet, size_ip);
            break;
        case IPPROTO_UDP:
            printf("\tProtocol: UDP\n");
            manage_udp_header(packet, size_ip);
            break;
        default:
            printf("\tProtocol: unknown = %i\n", ip->ip_p);
            return;
    }

    if (size_transport == -1)
        return;

    /* define/compute tcp payload (segment) offset */
    payload = (u_char *) (packet + SIZE_ETHERNET + size_ip + (size_transport));

    /* compute tcp payload (segment) size */
    size_payload = ntohs(ip->ip_len) - (size_ip + size_transport);

    /*
     * Print payload data; it might be binary, so don't just
     * treat it as a string.
     */
    if (size_payload > 0) {
        printf("\tPayload (%d bytes):\n", size_payload);
        //print_payload(payload, size_payload);
    }
}

/*
 * dissect/print packet
 */
void
got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) {

    /* declare pointers to packet headers */
    const struct sniff_ethernet *ethernet; /* The ethernet header [1] */

    printf("=============================================================================\n");
    printf("\nPacket number %d:\n", count++);

    /* define ethernet header */
    ethernet = (struct sniff_ethernet*) (packet);
    switch (ntohs(ethernet->ether_type)) {
        case 2048:
            manage_ip_header(packet);
            break;
        case 2054:
            printf("\tPaquete ARP.\n");
            narp++;
            break;
        case 32821:
            printf("\tPaquete RARP.\n");
            nrarp++;
            break;
    }

    pcap_dump(package_file, header, packet);

    printf("\nESTADÍSTICAS\n");
    printf("------------\n");
    printf("RED:\n");
    printf("\tIP: %.2f %\n", nip * 100 / (count - 1));
    printf("\tARP: %.2f %\n", narp * 100 / (count - 1));
    printf("\tRARP: %.2f %\n", nrarp * 100 / (count - 1));
    printf("TRANSPORTE:\n");
    printf("\tTCP: %.2f %\n", ntcp * 100 / (count - 1));
    printf("\tUDP: %.2f %\n", nudp * 100 / (count - 1));
    printf("\tOTROS: %.2f %\n", (count - 1 - ntcp - nudp)*100 / (count - 1));
    printf("=============================================================================\n");

    return;
}

int main(int argc, char **argv) {

    char *dev = NULL; /* capture device name */
    char * filter_exp = strdup("ether proto \\arp or \\rarp or \\ip or proto \\udp or proto \\tcp"); /* filter expression [3] */
    pcap_t *handle = NULL; /* packet capture handle */
    char errbuf[PCAP_ERRBUF_SIZE]; /* error buffer */
    /* Recibe la opción siguiente */
    int siguiente_opcion;

    /* Una cadena que lista las opciones cortas válidas */
    const char* const op_cortas = "hifrw:";

    /* Un array describiendo los valores largos correctos. */
    const struct option op_largas[] = {
        { "help", 0, NULL, 'h'},
        { "interface", 1, NULL, 'i'},
        { "filter", 1, NULL, 'f'},
        { "reader", 1, NULL, 'r'},
        { "writer", 1, NULL, 'w'},
        { NULL, 0, NULL, 0}
    };

    while ((siguiente_opcion = getopt_long(argc, argv, op_cortas, op_largas, NULL)) > 0) {
        printf("--- %c\n", optarg);
        switch (siguiente_opcion) {
            case 'h': /* -h o --help */
                print_app_usage();
                exit(EXIT_SUCCESS);
            case 'i': /* -v o --verbose */
                dev = optarg;
                break;
            case 'f': /* -o ó --output */                
                //filter_exp = malloc(sizeof (strlen(optarg) + 1)); /* optarg contiene el argumento de -o */
                //filter_exp = strdup(optarg);
                break;
            case 'r': /* opción no valida */
                handle = pcap_open_offline(optarg, errbuf); /* packet capture handle */
                exit(1);
            case 'w': /* opción no valida */
                package_file = pcap_dump_open(handle, "packet_file");
                exit(1);
            case -1 : /* No hay más opciones */
                break;
            default: /* Algo más? No esperado. Abortamos */
                abort();
        }
    }

    struct bpf_program fp; /* compiled filter program (expression) */
    bpf_u_int32 mask; /* subnet mask */
    bpf_u_int32 net; /* ip */
    int num_packets = -1; /* number of packets to capture */

    print_app_banner();

    /* find a capture device if not specified on command-line */
    if ((dev = pcap_lookupdev(errbuf)) == NULL) {
        if (dev == NULL) {
            fprintf(stderr, "Couldn't find default device: %s\n",
                    errbuf);
            exit(EXIT_FAILURE);
        }
    }

    /* get network number and mask associated with capture device */
    if (pcap_lookupnet(dev, &net, &mask, errbuf) == -1) {
        fprintf(stderr, "Couldn't get netmask for device %s: %s\n",
                dev, errbuf);
        net = 0;
        mask = 0;
    }

    /* print capture info */
    printf("Device: %s\n", dev);
    printf("Number of packets: %d\n", num_packets);
    printf("Filter expression: %s\n", filter_exp);

    /* open capture device */
    if (handle == NULL)
        handle = pcap_open_live(dev, SNAP_LEN, 1, 1000, errbuf);
    if (handle == NULL) {
        fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
        exit(EXIT_FAILURE);
    }

    /* make sure we're capturing on an Ethernet device [2] */
    if (pcap_datalink(handle) != DLT_EN10MB) {
        fprintf(stderr, "%s is not an Ethernet\n", dev);
        exit(EXIT_FAILURE);
    }

    /* compile the filter expression */
    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
        fprintf(stderr, "Couldn't parse filter %s: %s\n",
                filter_exp, pcap_geterr(handle));
        exit(EXIT_FAILURE);
    }

    /* apply the compiled filter */
    if (pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr, "Couldn't install filter %s: %s\n",
                filter_exp, pcap_geterr(handle));
        exit(EXIT_FAILURE);
    }


    conn1 = malloc(sizeof (tcp_conn));
    conn1->state = 0;
    conn2 = malloc(sizeof (tcp_conn));
    conn2->state = 0;
    
    /* now we can set our callback function */
    if (package_file == NULL)
        package_file = pcap_dump_open(handle, "packet_file");

    pcap_loop(handle, num_packets, got_packet, NULL);
    pcap_dump_flush(package_file);
    pcap_dump_close(package_file);

    /* cleanup */
    pcap_freecode(&fp);
    pcap_close(handle);

    printf("\nCapture complete.\n");

    return 0;
}